Strix v1.7.1 - AI Penetration Testing Tools

Strix is an AI powered security platform designed to help organizations detect vulnerabilities, monitor threats, and protect digital assets.

Depending on the implementation, Strix platforms typically fall into two categories:

  • AI penetration testing tools that simulate real attackers

  • Digital risk protection platforms that monitor threats across the internet

These systems use artificial intelligence to analyze large amounts of data and provide actionable security insights.

Download Strix v1.7.1 - AI Penetration Testing Tools - Software Mirrors

Download Strix for Linux
strix_agent-1.7.1-py3-none-manylinux_2_17_x86_64.whl

Download Strix for Linux
strix_agent-1.7.1-py3-none-manylinux_2_17_aarch64.whl

Download Strix for Windows
strix-1.7.1-windows-x86_64.zip

Download Strix for macOS - Intel
strix-1.7.1-macos-x86_64.tar.gz

Download Strix for macOS - Silicon
strix-1.7.1-macos-arm64.tar.gz

Download Strix for Linux
strix-1.7.1-linux-x86_64.tar.gz

Download Strix for Linux
strix-1.7.1-linux-arm64.tar.gz

Strix v1.7.1 - AI Penetration Testing Tools Release Notes:

What's Changed

  • Stop the run after finish_pr_review by @ian-at-strix in #1451
  • Stop false "ended without calling finish_scan" error on PR reviews by @ian-at-strix in #1449
  • feat(cli): add -r and a title column to the resume picker by @ian-at-strix in #1450
  • feat(tui): set the terminal title to the scan target by @ian-at-strix in #1479
  • fix(logging): suppress Agents SDK PTY warning that interferes with TUI by @ian-at-strix in #1392
  • feat(llm): detect whether a model accepts image input by @ian-at-strix in #1460
  • feat(llm): keep images away from text-only models by @ian-at-strix in #1465
  • feat(llm): scrub images from every request to a text-only model by @ian-at-strix in #1466
  • fix(execution): only strip images on image-rejection errors by @ian-at-strix in #1461
  • feat(llm): log the upstream provider behind OpenRouter by @ian-at-strix in #1459
  • feat(llm): retry 4xx model errors by @ian-at-strix in #1486
  • feat(llm): bound the first stream event and the whole stream by @ian-at-strix in #1487
  • fix(mcp): load catalogs before agents discover connections by @bearsyankees in #1492
  • Let callers choose the top-level agent's finish tool by @ian-at-strix in #1496
  • docs(readme): add update instructions by @yoni-at-strix in #1501
  • feat(reporting): accept code_locations on dependency reports by @yoni-at-strix in #1366
  • feat(tui): show the run's targets in a sidebar box by @ian-at-strix in #1500
  • fix(proxy): log Caido SDK errors as warnings by @ian-at-strix in #1517
  • feat(runtime): add defer=True to create_or_reuse so the agent loop does not wait for the sandbox bring-up by @devin-ai-integration[bot] in #1518
  • feat(runtime): accept an awaitable extra_files in create_or_reuse so the sandbox create does not wait for it by @devin-ai-integration[bot] in #1521
  • fix(reporting): drop the static-analysis disclaimer from dependency evidence by @yoni-at-strix in #1520
  • test(resume-picker): put the pty in cbreak so the key-reader test can't hang on macOS by @ian-at-strix in #1527
  • fix(models): replay malformed tool-call arguments as valid JSON by @bearsyankees in #1327
  • feat(llm): extra request-body fields via LLM_EXTRA_BODY by @SzymonNastaly in #1495
  • fix(agents): exec_command states the 30 s yield cap and that a running non-TTY process cannot be polled by @devin-ai-integration[bot] in #1535
  • fix(core): an operator pause holds under every budget policy and only resume_budget lifts it by @devin-ai-integration[bot] in #1536
  • feat(run): STRIX_RUN_RECORD_TIMINGS records every LLM request's and tool call's timing in run.json by @ian-at-strix in #1539
  • feat(agents): let callers choose the report tool by @ian-at-strix in #1550
  • fix(reporting): keep HTTP exchange evidence when the proxy is slow to… by @bearsyankees in #1551
  • build(deps): enforce a 5-day release cooldown for uv and npm resolution by @bearsyankees in #1556
  • feat(skills): expand XSS coverage for HTML injection and normalization by @theo-at-strix in #1559
  • Bump aiohttp, graphql-core, vite and trufflehog by @bearsyankees in #1569
  • Make the root agent follow up open coverage rows before finishing by @bearsyankees in #1573
  • feat(agents): soft per-skill turn limits for sub-agents by @ian-at-strix in #1553
  • feat(core): opt-in parallel tool calls via STRIX_PARALLEL_TOOL_CALLS by @ian-at-strix in #1555
  • feat(agents): let callers turn off the coverage ledger tools by @ian-at-strix in #1584
  • feat(runtime): pass host devices from STRIX_DOCKER_SANDBOX_DEVICES through to the sandbox container by @devin-ai-integration[bot] in #1587
  • docs: add Vercel AI Gateway as recommended provider by @devin-ai-integration[bot] in #1591
  • docs: use the vercel_ai_gateway provider for the Vercel AI Gateway setup by @devin-ai-integration[bot] in #1593
  • docs: show Vercel AI Gateway and OpenRouter in the README setup by @devin-ai-integration[bot] in #1594
  • feat(runner): let root_instructions_override replace the root's scan prompt by @ian-at-strix in #1592
  • refactor(runner): default replace_scan_prompt to False by @ian-at-strix in #1598
  • docs(config): describe the current STRIX_API_TYPE default by @Thibaultjaigu in #1602
  • feat(llm): send app attribution headers to Vercel AI Gateway by @devin-ai-integration[bot] in #1603
  • fix(image): patch brotli decoder (CVE-2026-111497) in sandbox, bump t… by @bearsyankees in #1617
  • fix(STR-1654): price LLM usage from model config by @bearsyankees in #1616
  • Feat/str 1646 opengrep by @bearsyankees in #1625
  • fix(report): validate deduplication decisions before suppressing findings by @samirhvbr in #1634
  • feat(skills): cover email identity canonicalization drift by @theo-at-strix in #1661
  • ci: one lean CI workflow with job timeouts; path-gate binary build and workflow lint by @devin-ai-integration[bot] in #1662
  • docs(skills): stop linking reference files that are not in this repo by @lxcxjxhx in #1690
  • Fix/str 2014 mcp refresh bearer on 401 by @bearsyankees in #1717
  • Feat/reachability three states by @yoni-at-strix in #1701
  • Fix/str 2195 sandbox updates by @bearsyankees in #1729
  • feat(skills): detect query-language and JSON parser differentials by @theo-at-strix in #1720
  • chore: release v1.7.1 by @devin-ai-integration[bot] in #1730

New Contributors

  • @SzymonNastaly made their first contribution in #1495
  • @theo-at-strix made their first contribution in #1559
  • @Thibaultjaigu made their first contribution in #1602
  • @samirhvbr made their first contribution in #1634
  • @lxcxjxhx made their first contribution in #1690
Full Changelog: v1.7.0...v1.7.1

Quick Start

Prerequisites:

  • Docker (running)

  • An LLM API key from any supported provider (OpenAI, Anthropic, Google, etc.)

Installation & First Scan

# Install Strix
curl -sSL https://strix.ai/install | bash

# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

# Run your first security assessment
strix --target ./app-directory

Usage Examples

Basic Usage

# Scan a local codebase
strix --target ./app-directory

# Security review of a GitHub repository
strix --target https://github.com/org/repo

# Black-box web application assessment
strix --target https://your-app.com

Advanced Testing Scenarios

# Grey-box authenticated testing
strix --target https://your-app.com --instruction "Perform authenticated testing using credentials: user:pass"

# Multi-target testing (source code + deployed app)
strix -t https://github.com/org/app -t https://your-app.com

# Focused testing with custom instructions
strix --target api.your-app.com --instruction "Focus on business logic flaws and IDOR vulnerabilities"

# Provide detailed instructions through file (e.g., rules of engagement, scope, exclusions)
strix --target api.your-app.com --instruction-file ./instruction.md

Headless Mode

Run Strix programmatically without interactive UI using the -n/--non-interactive flag—perfect for servers and automated jobs. The CLI prints real-time vulnerability findings, and the final report before exiting. Exits with non-zero code when vulnerabilities are found.

strix -n --target https://your-app.com

CI/CD (GitHub Actions)

Strix can be added to your pipeline to run a security test on pull requests with a lightweight GitHub Actions workflow:

name: strix-penetration-test

on:
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Strix
        run: curl -sSL https://strix.ai/install | bash

      - name: Run Strix
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}

        run: strix -n -t ./ --scan-mode quick

Configuration

export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

# Optional
export LLM_API_BASE="your-api-base-url"  # if using a local model, e.g. Ollama, LMStudio
export PERPLEXITY_API_KEY="your-api-key"  # for search capabilities
export STRIX_REASONING_EFFORT="high"  # control thinking effort (default: high, quick scan: medium)

Key Features of Strix

AI Driven Penetration Testing

Some versions of Strix act like automated ethical hackers.

They can:

  • Scan applications for vulnerabilities

  • Simulate real world attack scenarios

  • Validate findings with proof of concept exploits

This approach reduces false positives and speeds up testing significantly.


Multi Agent Security System

Strix uses multiple AI agents working together to perform complex security tasks.

Capabilities include:

  • Parallel vulnerability scanning

  • Coordinated attack simulations

  • Shared intelligence between agents

This allows faster and more comprehensive testing compared to manual methods.


Digital Risk Monitoring

Another core capability is monitoring threats across external sources.

Strix can track:

  • Dark web activity

  • Data leaks and exposed credentials

  • Phishing domains and impersonation

  • Threat actor behavior

This helps organizations detect risks before they escalate.


Attack Surface Mapping

Strix continuously scans and maps an organization’s external footprint.

It identifies:

  • Public facing assets

  • Subdomains and services

  • Potential entry points for attackers

This provides a clear view of security exposure.


CI/CD Integration

Strix integrates with development workflows to improve security during development.

Features include:

  • Automated scans during code changes

  • Blocking vulnerabilities before deployment

  • Continuous monitoring of new risks

This is especially useful for DevSecOps environments.


Reporting and Insights

The platform generates detailed reports with:

  • Verified vulnerabilities

  • Risk severity levels

  • Suggested remediation steps

This helps teams prioritize and fix issues efficiently.


Performance and Usability

Strix is designed for technical users such as developers and security teams.

Performance highlights:

  • Fast automated scanning

  • Scalable multi agent architecture

  • Real time threat analysis

Usability considerations:

  • Requires understanding of cybersecurity concepts

  • Setup and configuration may be complex

  • Best suited for professional environments


Pros and Cons

Advantages

  • AI driven security automation

  • Reduces manual penetration testing effort

  • Real time threat monitoring

  • Integrates with development pipelines

  • Provides actionable security insights


Limitations

  • Not a replacement for human security experts

  • May require advanced technical knowledge

  • Limited visibility compared to established enterprise tools

  • Effectiveness depends on configuration and data quality


Who Should Use Strix

Strix is best suited for:

  • Cybersecurity professionals

  • DevSecOps teams

  • Organizations protecting digital assets

  • Developers building secure applications

It is particularly useful for teams that want to integrate AI into security workflows.


Final Verdict

Strix represents a new generation of AI powered cybersecurity tools that combine automated penetration testing with real time threat monitoring. Its ability to simulate attackers, analyze risks, and integrate into development pipelines makes it a powerful solution for modern security challenges.

For organizations looking to improve security efficiency and reduce manual workload, Strix is a forward looking and capable platform.

Strix v1.7.1 - AI Penetration Testing Tools
Free
Software Informations:
Developer:

Operating System:
Windows / macOS / Linux
Date Added:
2026-11-11T03:07:23.310Z
Categories:

Post a Comment/Report Broken Link: